A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1 < 14.15.1 and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1 14.15.1 and 12.19.1.

🗓️ 09 Mar 2021 08:00:00Reported by MicrosoftType

Denial of service via excessive domain name resolutions in older Node.js versions; fixed in fifteen two one, fourteen one five one, and twelve nineteen one.

Reporter	Title	Published	Views	Family All 224
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities	15 Jan 202114:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Storage Defender – Data Protect	26 Mar 202503:57	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security contains security vulnerabilities	13 May 202121:45	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management.	19 Feb 202105:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js vulnerability	11 Dec 202016:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to a denial of service attack through a DNS lookup that returns a large number of responses (CVE-2020-8277)	29 Apr 202111:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is vulnerable to denial of service (DoS) via Node.js (CVE-2020-8277)	6 Mar 202117:41	–	ibm
IBM Security Bulletins	Security Bulletin: Version 12.18.4 of Node.js included in IBM Netcool Operations Insight 1.6.2.x has a security vulnerability	15 Dec 202018:47	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Automation Manager.	15 May 202312:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud	9 Dec 202021:05	–	ibm

Vulners

Node

microsoft cbl2_python-gevent_21.1.2-3Range<21.1.2-3

microsoft cm1_c-ares_1.17.1-1Range<1.17.1-1

09 Mar 2021 08:00Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 3.17.5

EPSS0.54164